Claude Code Don't Ask Again Sensitive Information Exposure

Claude Code | Sensitive Information Exposure | Developer Security | Source Control | Credential Hygiene

Source Material: Source Material: Apiiro Research | Technology: Anthropic Claude Code | Targeting: Opportunistic – Organizations and developers using Claude Code with source control

Executive Summary

Security researchers have disclosed a Claude Code configuration behavior in which ‘Yes, and don’t ask again’ for a command can persist the approved command text in a project settings file. If the command contains a literal password, token, connection string, or other secret, the credential may be stored in plaintext in .claude/settings.local.json or, in some workflows, the shared .claude/settings.json file.

Researchers identified 1,379 distinct secrets in 1,122 public .claude/settings.local.json files and 2,539 secrets across 1,994 repositories when Git history, shared settings, and agent transcripts were included. The researchers did not validate most credentials; one organization confirmed that an exposed key had been live. While malicious use of the identified credentials has not been confirmed, abuse is highly likely now that this issue has been publicized.

While no CVE currently exists for this issue, Deepwatch is publishing this advisory to protect and inform our customers due to the combination of a convenient AI feature and common developer workflows which has led to significant potential credential exposure. We strongly encourage customers to review potentially exposed secrets to prevent malicious activity. Anthropic has publicly acknowledged the issue and is exploring preventative measures, including built-in secret scrubbing. In the meantime, customers should immediately search current and historical repository content, rotate every exposed credential before rewriting history, and strictly prevent Claude Code project-local settings from entering source control.

Threat Overview and Strategic Impact

Claude Code uses permission rules to reduce repeated prompts. Anthropic’s documentation states that a permanent command approval is saved per repository and command in .claude/settings.local.json. The same documentation says Claude Code adds this file to the machine’s global Git excludes when Claude Code creates it; that protection is machine-local and does not protect a manually created file, a file that is already tracked, a copied workspace, or a different developer machine or container. A reported VS Code extension issue also describes approvals being written to the shared, version-controlled .claude/settings.json file.

Exposure occurs when a user selects ‘Yes, and don’t ask again’ to approve and store a command containing a literal secret, such as an authorization header, database connection string, password environment assignment, or sshpass argument. Claude Code may serialize the command as a permissions.allow entry. The secret then becomes durable configuration data inside the project. If the file is committed, pushed, included in an archive, synchronized, or copied, anyone with access to that location may recover the credential. Removing the current file does not remove prior commits, forks, clones, caches, or downstream copies. Notably, researchers found that in a significant portion of the affected repositories, a commit co-authored by Claude Code itself was responsible for adding the sensitive settings file to version control.

Security researchers found 104,185 copies of .claude/settings.local.json; 1,122 contained at least one likely real secret. The researchers reported database passwords, service and AI API keys, cloud keys, source-control and package-registry tokens, SSH credentials, application passwords, and private keys. Secret scanners did not detect every affected file, particularly when a password lacked a provider-specific format and appeared inside ordinary command syntax.

Affected scope is configuration-based rather than tied to a confirmed model or product version. Organizations are most at risk where developers embed secrets directly in commands, retain literal permanent approvals, share Claude Code settings, or lack repository-wide secret scanning and push protection. Potential impact includes unauthorized access to databases, cloud resources, source repositories, package registries, third-party services, and sensitive customer data. No specific intrusion set has been attributed, and public reporting does not establish active malicious use of the exposed credentials.

Security Hardening and Recommendations

Inventory all repositories, forks, build artifacts, developer workspaces, and Git history for .claude/settings.local.json, .claude/settings.json, and Claude Code transcripts. Treat any discovered credential as compromised.
Rotate or revoke exposed passwords, keys, and tokens before removing files or rewriting history. Review the affected service’s authentication and audit logs from the earliest possible exposure time.
Remove project-local settings from tracking and add **/.claude/settings.local.json to repository-level .gitignore and centralized ignore policies. Review shared .claude/settings.json before every commit.
Keep secrets out of command text. Use environment-variable references backed by an approved secrets manager, short-lived credentials, workload identity, or platform-native credential helpers.
Prefer narrowly scoped permission patterns that contain no secret material. Review permanent permissions.allow entries and avoid broad rules that weaken least privilege.
Enable secret scanning and push protection, including custom patterns for passwords embedded in shell commands. History rewriting is secondary containment and does not replace credential rotation.

Detection Strategy

Detection should combine source-control, endpoint, and identity telemetry. Scan current content and full Git history for Claude Code settings and transcripts, then inspect permissions.allow values for credential-bearing syntax such as Authorization headers, connection URI user-info, password environment assignments, sshpass -p, database client password flags, private keys, and provider token formats. Use multiple secret-detection methods and custom contextual rules because format-based scanners may miss ordinary passwords embedded in commands.

Monitor repository events for first-time addition, modification, or publication of .claude/settings*.json, especially when followed by a push to a public repository. On managed developer endpoints, correlate creation or modification of these files with git add, git commit, archive creation, synchronization, or upload activity. After identifying exposure, pivot to the relevant cloud, database, identity, SaaS, and source-control audit logs for use of the affected credential from new IP addresses, geographies, devices, user agents, or atypical services. Establish the earliest commit or sharing time as the beginning of the review window.

How Deepwatch Protects Our Customers

Deepwatch recommends a defense-in-depth monitoring approach because the initial write often occurs on a developer workstation while the consequential activity appears later in source-control or identity telemetry. Where customers provide applicable endpoint, Git hosting, cloud, identity, database, or SaaS logs, the Deepwatch SOC can investigate alerts for exposed secrets, anomalous repository access, and suspicious access. Detection coverage depends on the telemetry sources onboarded and the credential providers.

Relevant Detections

Please visit the Guardian Platform to access the relevant detections for this activity and ask NEXA Detection Advisor for a breakdown of which detections are enabled in your environment.

Threat Hunting Leads

Search all branches and full Git history for .claude/settings.local.json, .claude/settings.json, and committed Claude Code transcripts.
Extract permissions.allow entries and hunt for password flags, connection strings, authorization headers, private-key material, and provider-specific token formats.
Identify the first commit, fork, release artifact, archive, or public exposure containing each secret and enumerate downstream clones or mirrors.
Correlate exposed credentials with authentication and API activity from unfamiliar infrastructure or outside established developer and CI/CD baselines.
Review developer endpoints for Claude settings creation or modification followed by Git staging, commit, push, synchronization, or archive/upload activity.

Technical Artifacts

Please visit the Guardian Platform to access available technical artifacts for this report.

Threat Object Mapping

Intrusion Set:

None identified. Available reporting documents exposed credentials but does not include confirmed malicious use at this time.

Attack Pattern (MITRE ATT&CK/MITRE ATLAS):

Tactic	Technique	Technique ID	Associated Threat Activity
Credential Access	Unsecured Credentials: Credentials In Files	T1552.001	Potential discovery and extraction of passwords, tokens, keys, and connection strings stored in Claude Code settings.
Collection	Data from Information Repositories: Code Repositories	T1213.003	Potential harvesting of credentials and sensitive data from public or compromised source-code repositories.

Vulnerabilities:

No CVE assigned. There is an opportunity for potential sensitive information exposure depending on configuration and implementation of Claude Code, repository commits, and secret management.